Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/catwillgh/mainframe/tickets-findnpx skills add CATWILLgh/MAINFRAME --skill tickets-findgit clone --depth 1 https://github.com/CATWILLgh/MAINFRAMEWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/catwillgh/mainframe/tickets-find)<a href="https://agentmods.dev/skills/catwillgh/mainframe/tickets-find"><img src="https://agentmods.dev/badge/skills/catwillgh/mainframe/tickets-find.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00030 | $0.00616 |
| Opus 5 | $0.00015 | $0.00308 |
| Sonnet 5 | $0.00006 | $0.00123 |
| Haiku 4.5 | $0.00003 | $0.00062 |
Grade A, and why
tickets-find scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Find ticket candidates
Do not start the search in the invocation turn. Return only this copyable block, with the invocation argument preserved as written:
/goal Follow the loaded tickets-find workflow. Scope: "$ARGUMENTS"; an empty scope means the whole current repository. First normalize current open tickets to the loaded canonical ticket structure without asking the user. Continue until every repository boundary and every limitation or non-coverage reported by delegated work has been accounted for, every concrete plausible finding has been recorded or merged with a clear open-ticket match, and a final control pass leaves no unprocessed findings or unexplained coverage gaps; or stop when the user asks to pause or cancel, or with an evidenced external blocker that prevents any eligible work from continuing. Before finishing, surface the normalization result, checked scope, examined and unexamined coverage, ticket outcomes, and completion evidence in the conversation.
When that goal starts, first read ticket-autonomous-runs.md, record-observation.md, and ticket-format.md.
Build a small coverage map from the repository's actual boundaries, manifests, entry points, interfaces, and major business areas. Select risk directions that fit each area instead of applying one generic checklist. Do not create a persistent repository map during this run.
Before building that map, apply the legacy-open-ticket normalization in
ticket-format.md. Do not ask how to classify an ambiguous legacy open record:
use its safe canonical fallback. Do not count normalization as a discovered
problem or silently refine its claims.
Inspect the full repository when the scope argument is empty. A plain-language argument may narrow the run to a path, component, or concern but grants no new authority. Record a candidate only when there is a concrete location or behavior and a plausible mechanism of harm. Do not require proof of cause, impact, priority, or full blast radius. Preferences, abstract improvements, and technology replacement merely because something newer exists are not tickets.
Search the open queue for a clear duplicate before every write. Append only a
materially different observation to a clear match; otherwise create a new
open/observations ticket. Do not run tests, servers, containers, migrations,
benchmarks, or external environments, and do not fix findings. Continue until
the coverage map and final control pass satisfy the goal condition. Every
limitation, omission, or NOT COVERED result from delegated work is unfinished
coverage until a further pass examines it or a concrete reason places it
outside scope or authority. Report remaining unexamined scope explicitly; do
not let an empty first-pass list prove completeness by itself.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 48 lines · 30 tokens per session scan A be26b1296c72
tickets-find is a skill published in the GitHub repository CATWILLgh/MAINFRAME (2 stars, last pushed 14d ago), licensed MIT. It adds 30 tokens to every session and 616 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cc-hooks
Multi-agent hook system: author hooks once as rulesync-canonical hooks.json (HookDefinitionSchema), deploy via superskill install / superskill hook emit to Claude Code, Codex, OpenCode, Pi (pi-hooks), and Gemini CLI. Covers command, prompt, and http hooks, cross-platform event mapping, and safety invariants.
merchant-pain-prevention
Use when designing, building, reviewing, or shipping a Shopify app to avoid the patterns that get merchants angry (1-2 star reviews, uninstalls, churn). Covers theme injection / leftover code on uninstall, surprise billing, fake urgency, slow scripts, cancel friction, scope creep, bot-only support, broken on platform…
app-pricing-strategy
Use when designing Shopify app pricing, choosing a pricing model (flat tiered / usage-based / freemium / hybrid), setting trial length (7/14/30 days), structuring 3-4 tier plans, sizing capped usage, raising prices on existing customers, or writing pricing copy for the App Store listing. Triggers: 'shopify app…
built-for-shopify-standards
Prepare a Shopify app for Built for Shopify status. Covers current quality criteria, performance, accessibility, Shopify admin integration, compliance webhooks, observability, support, application readiness, and ongoing eligibility.
dev-troubleshooting
Use when a Shopify dev workflow is failing — shopify app dev cryptic errors, Cloudflare tunnel not starting, App Bridge v3→v4 migration 'No AppBridge context provided', GraphQL 200 OK with throttle errors, webhook 401, double-subscribed webhooks, app proxy 404, REST 302 loops, Rust function wasm-validator errors…
ux-modern-app-feel
Use when you want a Shopify embedded app to feel modern, fast, and opinionated like Linear, Notion, Vercel, or Cron — speed-first, keyboard-first, calm UI, opinionated defaults, no-config success path. Covers keyboard shortcuts inside App Bridge, command palette patterns, micro-interactions Polaris allows, density vs…